Law firms
Since 1 October 2025, a criminal legal aid contract requires a valid Cyber Essentials certificate. The PII proposal form and the client panel audit ask the same questions with different letterheads.
We implement Cyber Essentials, CE+, and ISO 27001 controls for firms of 30-100 staff. An accredited assessor certifies. Your MSP stays.
CE+ readiness from £2,950, fixed. ISO 27001 from £15,000.
Who this is for
Law firms of 30-100 staff. An MSP runs the queue. Nobody owns the evidence. The managing partner, the COO, or the practice director has become the person the cyber questions land on.
Criminal practices with a legal aid contract to keep. Civil and commercial firms whose PII renewal, lender panel, or corporate client has started asking for certificates instead of assurances.
The contract clock
What we do
We implement. We do not certify.
Your MSP stays and does what it does well. Much of the remediation lands in their queue. We scope it, own it, and evidence it.
The price
Cyber Essentials Plus readiness and remediation: from £2,950, fixed. The assessor's certification fee is separate and paid to the certification body.
ISO 27001 implementation: from £15,000, scoped at the diagnose stage. The UKAS-accredited audit is separate.
Fixed pieces of work, priced in writing before anything starts.
Questions
For criminal legal aid, yes. Since 1 October 2025 the Legal Aid Agency has required practices holding a 2025 Standard Crime Contract to hold a valid Cyber Essentials certificate as a condition of the contract. If that renewal is coming, the readiness work is this page.
The PII proposal form, the client panel audit, and the lender or corporate client questionnaire all ask the same questions Cyber Essentials answers. A certificate is the short way to stop answering them one form at a time.
Keep the MSP. Much of the remediation lands in their queue anyway. What we add is scope, ownership and evidence: one named senior who owns the gap list, signs the pack, and answers the partner who asks how safe the firm actually is.
No. The Technology Framework is not a certification body. We implement the controls. An accredited assessor certifies CE, CE+, and ISO 27001.
CE+ readiness from £2,950, fixed. ISO 27001 implementation from £15,000, scoped at diagnose. Assessor and audit fees are separate, paid to the accredited bodies.
The seat exists and some firms outgrow tickets into it. This page sells the evidence work. If the firm needs a named IT leader in the room, that is a separate conversation.
Related
